RVST Holdings, LLC v. Main Street America Assurance Company

Rose, J. Appeal from an order of the Supreme Court (Reilly Jr., J.), entered October 23, 2014 in Schenectady County, which, among other things, denied defendant’s motion for summary judgment dismissing the complaint. Plaintiffs operate fast food restaurants and store their customers’ credit card information on their computer network. The network was infiltrated by unknown individuals who unlawfully obtained the customers’ card information and then used that information to make numerous fraudulent charges. Nonparty Trasteo Bank subsequently commenced an action against plaintiffs that alleged, as relevant here, that plaintiffs had negligently failed to exercise reasonable care in safeguarding the information of Trasteo cardholders, which, in turn, caused Trasteo to sustain damages related to its reimbursement of the fraudulent charges. Plaintiffs then sought coverage under their business owner’s insurance policy issued by defendant. After an investigation, however, defendant declined to *1197 defend or indemnify plaintiffs in the underlying Trasteo action, asserting that the policy excludes from coverage third-party claims arising out of the loss of electronic data. Plaintiffs thereafter commenced this action against defendant seeking, among other things, a declaration requiring defendant to defend and indemnify them in the underlying action. Following joinder of issue, defendant moved for summary judgment. Supreme Court denied the motion, searched the record and granted summary judgment to plaintiffs, declaring that defendant has a duty to defend them. Defendant now appeals, and we reverse. * An insurer’s duty to defend its insured is “exceedingly broad” (Automobile Ins. Co. of Hartford v Cook, 7 NY3d 131, 137 [2006] [internal quotation marks and citation omitted]). It is well settled, however, that an insurer need not provide a defense when it can “demonstrate that the allegations of the [underlying] complaint cast that pleading solely and entirely within the policy exclusions, and, further, that the allegations, in toto, are subject to no other interpretation” (id.; see Sportsfield Specialties, Inc. v Twin City Fire Ins. Co., 116 AD3d 1270, 1274 [2014], lv denied 23 NY3d 909 [2014]; J. Lucarelli & Sons, Inc. v Mountain Val. Indem. Co., 64 AD3d 856, 858 [2009]). Defendant argues that it has no duty to defend plaintiffs in the underlying action because Trustco’s claim arose out of the theft and misuse of electronic data stored on plaintiffs’ computer network — a claim that is not covered by the liability section of plaintiffs’ insurance policy. Initially, we note that the nature of the allegations contained in Trustco’s complaint is not in dispute. Indeed, in their own complaint in this action, plaintiffs agree with defendant that Trustco’s claims in the underlying action are based upon “losses due to the theft and subsequent misuse of electronic account data and/or electronic vandalism at certain [of plaintiffs’ restaurant] locations.” Nor is there any dispute that the electronically stored cardholder information at issue in the underlying action qualifies as “electronic data” under the policy’s definition of that term. Thus, the only remaining question is whether the policy clearly and unmistakably excludes from coverage third-party damages flowing from stolen electronic data. The liability section of plaintiffs’ policy provides, as relevant here, that “[defendant] will pay those sums that [plaintiffs] *1198 become [ ] legally obligated to pay as damages because of . . . ‘property damage.’ ” The policy defines “property damage” as “[p]hysical injury to tangible property . . . or . . . [l]oss of use of tangible property that is not physically injured.” Crucially, the policy further states that, “[f]or the purposes of this insurance, electronic data is not tangible property.” Moreover, the policy specifically excludes “[d]amages arising out of the loss of . . . electronic data.” In light of this unambiguous language, we agree with defendant that Trustco’s claim for damages arising out of plaintiffs’ negligent handling of electronic data is not a claim for “property damage” under the policy and is excluded from coverage. Accordingly, defendant has no duty to defend plaintiffs against Trustco (see e.g. Sportsfield Specialties, Inc. v Twin City Fire Ins. Co., 116 AD3d at 1274-1275). Although plaintiffs attempt to avoid this result by arguing that defendant has a duty to defend based upon provisions of a separate section of the policy providing coverage for property damage, the coverage provided under that section is expressly limited to plaintiffs’ claims for “direct physical loss of or damage to” plaintiffs’ own property. Unlike the liability section of the policy, for which plaintiffs paid a separate premium, the property damage section contains no language indicating that it covers the claims of third parties. Thus, the property damage section of the policy provides only first-party coverage for direct damage to plaintiffs’ property, a claim not made by plaintiffs here and, further, one that “does not involve any need or duty to provide the insured with a legal defense” (14 Plitt et al., Couch on Insurance 3d § 198:3 [2015]; see Great N. Ins. Co. v Mount Vernon Fire Ins. Co., 92 NY2d 682, 687-688 [1999]; Slattery Skanska Inc. v American Home Assur. Co., 67 AD3d 1, 11-12 [2009]). In light of our decision, we need not reach defendant’s remaining argument. Peters, P.J., McCarthy and Lynch, JJ., concur. Ordered that the order is reversed, on the law, with costs, summary judgment in plaintiffs’ favor denied, defendant’s motion for summary judgment granted, and complaint dismissed. Footnotes [*] Although defendant appealed from Supreme Court’s order and not from the subsequent judgment, we will exercise our discretion to deem the appeal to have been taken from the final judgment (see CPLR 5520 [c]; Feldin v Doty, 45 AD3d 1225, 1226 n [2007]).